GHSA-r7p8-xq5m-436c Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables

• Maven org.eclipse.jetty.ee11:jetty-ee11-jaspi: >= 12.1.0, < 12.1.8 → fixed in 12.1.8 • Maven org.eclipse.jetty.ee10:jetty-ee10-jaspi: >= 12.1.0, < 12.1.8 → fixed in 12.1.8 • Maven org.eclipse.jetty.ee9:jetty-ee9-jaspi: >= 12.1.0, < 12.1.8 → fixed in 12.1.8 • Maven org.eclipse.jetty.ee8:jetty-ee8-jaspi: >= 12.1.0, < 12.1.8 → fixed in 12.1.8 • Maven org.eclipse.jetty.ee11:jetty-ee11-jaspi: >= 12.0.0, < 12.0.34 → fixed in 12.0.34 • Maven org.eclipse.jetty.ee10:jetty-ee10-jaspi: >= 12.0.0, < 12.0.34 → fixed in 12.0.34 • Maven org.eclipse.jetty.ee9:jetty-ee9-jaspi: >= 12.0.0, < 12.0.34 → fixed in 12.0.34 • Maven org.eclipse.jetty.ee8:jetty-ee8-jaspi: >= 12.0.0, < 12.0.34 → fixed in 12.0.34 • Maven org.eclipse.jetty:jetty-jaspi: >= 11.0.0, < 11.0.29 → fixed in 11.0.29 • Maven org.eclipse.jetty:jetty-jaspi: >= 10.0.0, < 10.0.29 → fixed in 10.0.29 • Maven org.eclipse.jetty:jetty-jaspi: >= 9.4.0, < 9.4.61 → fixed in 9.4.61

Description (as reported) A security vulnerability has been identified in Jetty's `JaspiAuthenticator.java`. The root cause is a failure to consistently clear authentication metadata stored in `ThreadLocal` during certain error or incomplete authentication flows. Specifically, after a `GroupPrincipalCallback` is persisted into the `ThreadLocal`, the authentication process may exit prematurely — before the `ThreadLocal` storage is cleared — if a mandatory `CallerPrincipalCallback` is missing or an exception occurs. This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation. See also attached PDF. Impact An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation). Patches No patches yet. Workarounds Do not use Jetty's JASPI.